AZ-400 Design and implement build and release pipelines Practice Test 3 — 15 Questions

Question 1

Your team is implementing a CI/CD pipeline for a .NET application. The build pipeline should only run when changes are pushed to the main branch, but a recent push to a feature branch triggered the pipeline. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The trigger includes 'main' and also has no branch filters, so all branches trigger builds.. In Azure Pipelines, `trigger: - main` is equivalent to `trigger: branches: include: - main`, restricting CI to main. If a feature branch push triggers the pipeline, the likely cause is that the trigger is missing/empty (defaults to all branches) or is malformed. Including 'main' is itself a branch filter, so it cannot be true that the trigger includes 'main' but has no branch filters.

Answer

The pull request trigger is enabled for the feature branch.

Answer

Path filters are configured to include all paths.

Answer

The CI trigger is disabled in the pipeline YAML.

Question 2

You run the above Azure CLI command to deploy a Bicep template. The deployment fails with 'The resource 'Microsoft.Storage/storageAccounts/mystgaccount' already exists'. What is the most likely cause?

Accepted Answer

The storage account 'mystgaccount' already exists in the resource group.. The error message explicitly states that the storage account 'mystgaccount' already exists. Azure storage account names are globally unique across all of Azure, so if a storage account with that name exists anywhere (in this resource group, another resource group, or another subscription), the deployment will fail. The most likely cause is that the storage account already exists in the target resource group, and the Bicep template is attempting to create it again without proper idempotency handling.

Answer

The command should use 'az deployment group validate' instead.

Answer

The Bicep file uses 'complete' mode.

Answer

The resource group 'MyRG' does not exist.

Question 3

Your release pipeline deploys to multiple environments (dev, test, prod). You need to ensure that only authorized users can approve production deployments. Which TWO actions should you take?

Accepted Answer

Add a 'Approval' check on the production environment.. Option D is correct because adding an Approval check directly on the production environment enforces that the protected resource itself requires authorized approvers before any pipeline can deploy to it, regardless of which pipeline targets it. Option E is correct because a pre-deployment approval on the production stage pauses the run and requires designated approvers to sign off before the stage executes, which is the classic mechanism for gating production deployments. Together these satisfy the requirement that only authorized users can approve production deployments. Option A is not the right fit because a manual intervention task is a generic pipeline task that notifies and waits, but it does not bind approvals to the production environment's authorization model. Option B is incorrect because release creation permissions control who can queue a release, not who can approve a production deployment. Option C is incorrect because deployment gates typically evaluate automated conditions such as REST API checks, Azure Monitor alerts, or work item queries, not user approval.

Answer

Use a manual intervention task in the pipeline.

Answer

Set environment permissions to allow only specific users to create releases.

Answer

Configure deployment gates to check for user approval.

Question 4

You have a pipeline with the above JSON definition. The build fails with 'The specified configuration 'Release' is not valid'. What is the most likely cause?

Accepted Answer

The configuration value should be 'debug' instead.. Azure Pipelines accepts JSON as YAML, so the error is not a format problem. The error 'The specified configuration 'Release' is not valid' is thrown when the value passed to the build configuration does not exist in the project. Since the error names 'Release', the variable is set to that value, but it is not supported. Changing the configuration to a valid one (such as 'debug') resolves the issue. Therefore, option A is the correct answer, not B.

Answer

The buildConfiguration variable is not set.

Answer

The pipeline definition is in JSON format, which is not supported by Azure Pipelines.

Answer

The DotNetCoreCLI task requires a specific version.

Question 5

You run the above KQL query in Log Analytics to troubleshoot a failing container in a Kubernetes deployment. The query returns no results even though you know there are errors. What is the most likely cause?

Accepted Answer

Container logs are not being sent to the ContainerLog table.. The explanation admits the query is missing, yet still asserts B is correct. Without seeing the query, it is impossible to determine whether the no-results issue is due to data collection, filtering, syntax, or case sensitivity. The question must include the actual KQL query to be valid.

Answer

The 'project' clause filters out relevant rows.

Answer

The 'contains' operator is case-sensitive.

Answer

The KQL syntax is incorrect.

Question 6

You have an Azure DevOps Pipeline that builds a Node.js application. The pipeline uses template expressions to conditionally run certain jobs based on the branch name. You notice that the condition 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' is not evaluating as expected. What is the most likely cause?

Accepted Answer

The variable 'Build.SourceBranch' is not available in the condition context.. The condition 'eq(variables['Build.SourceBranch'], 'refs/heads/main')' is used in a template expression, which is evaluated at compile time. However, 'Build.SourceBranch' is a runtime variable that is not available during compile time, causing the condition to fail. Template expressions can only reference parameters or variables defined within the template itself, not runtime pipeline variables. To conditionally run jobs based on the branch, use a runtime condition (e.g., in the 'condition' property of a job or stage) instead of a template expression.

Answer

The variable 'Build.SourceBranch' is misspelled; it should be 'Build.SourceBranchName'.

Answer

The condition syntax is correct but the branch name should not include 'refs/heads/'.

Answer

The condition should be in a template expression instead of a runtime condition.

Question 7

You are designing a release pipeline for a microservices application where each service is built as a Docker container and deployed to Azure Kubernetes Service (AKS). You want to ensure that each service is deployed independently to the same cluster. The services have dependencies on each other. Which deployment strategy should you use?

Accepted Answer

Rolling update using Kubernetes Deployment strategies.. Rolling update using Kubernetes Deployment strategies is the standard way to update a service independently. It replaces pods incrementally, allowing the new version to become healthy before continuing. This minimizes downtime and works well with dependent services via readiness/liveness probes. Blue-green deployment (D) in Kubernetes is typically implemented with separate Deployments and label selectors, not necessarily entire stacks; however, using namespaces for isolation is not a standard blue-green pattern. The other options are incorrect for the reasons given.

Answer

Canary deployment with traffic splitting via Istio.

Answer

Immutable infrastructure with new cluster per deployment.

Answer

Blue-green deployment to AKS using Kubernetes namespaces for isolation.

Question 8

Your team uses Azure Pipelines to deploy a web app to Azure App Service. The deployment uses the 'AzureWebApp@1' task with a deployment slot. You need to ensure that after a successful deployment to the staging slot, the slot swap happens automatically and the staging slot is warmed up before the swap. Which configuration should you use?

Accepted Answer

Set the 'Slot' parameter to 'staging' and enable 'Swap with production' in the task.. The 'AzureWebApp@1' task includes a 'Swap with production' checkbox that, when enabled, automatically performs a slot swap after the deployment to the specified slot (e.g., staging) completes. This ensures the staging slot is warmed up by the deployment process before the swap, as the swap operation respects the warm-up phase of the target slot, preventing downtime and ensuring the production slot receives a fully initialized application.

Answer

Use the 'Azure App Service manage' task to swap slots after deployment.

Answer

Use the 'Azure CLI' task to run 'az webapp deployment slot swap' after deployment.

Answer

Configure the deployment task to deploy to staging and then use a separate task to swap.

Question 9

Which TWO of the following are valid strategies to securely store and use secrets in Azure Pipelines?

Accepted Answer

Link a variable group to Azure Key Vault and reference variables in the pipeline.. Option A is correct because linking a variable group to Azure Key Vault lets Azure Pipelines fetch secrets at runtime from Key Vault, so the secret values are never stored in the pipeline definition and are masked in logs. Option B is correct because the AzureKeyVault task (AzureKeyVault@2) explicitly downloads specified secrets from an Azure Key Vault instance into the pipeline run, allowing them to be consumed as variables without persisting them in source control. Option C is wrong because hardcoding a secret value in YAML, even as a 'secret' variable type, exposes the plaintext in the repository and does not provide secure storage. Option D is wrong because storing secrets in a repository text file exposes them to anyone with repo access and violates secret-management best practices. Option E is wrong because it refers to GitHub Actions, not Azure Pipelines, so it is not a valid strategy for the scenario.

Answer

Use the 'secret' variable type in YAML and hardcode the value.

Answer

Store secrets in a text file in the repository and use a script to read them.

Answer

Use encrypted environment variables in GitHub Actions.

Question 10

Refer to the exhibit. This YAML pipeline snippet uses parameters to deploy to different environments. The team wants to run the pipeline for a specific environment by providing the parameter at queue time. However, the pipeline fails with 'Invalid stage name'. What is the most likely cause?

Accepted Answer

Stage names cannot contain template expressions; they must be static.. In Azure Pipelines, stage names must be valid identifiers (letters, numbers, underscores, starting with a letter). Template expressions are allowed and evaluated at compile time. If the parameter value provided at queue time contains spaces or other invalid characters (e.g., 'Dev Environment'), the pipeline fails with 'Invalid stage name'. The fix is to use a valid identifier as the stage name and a displayName for the human-readable label.

Answer

The parameter values must be defined in a separate file.

Answer

The 'AzureWebApp@1' task inputs are incorrectly formatted.

Answer

The 'stage' keyword should be 'stageName'.

Question 11

Your team uses Azure DevOps to build a .NET application. The build pipeline takes 45 minutes to complete. You want to reduce build times by caching dependencies. What should you configure in the pipeline?

Accepted Answer

Add a Cache task with a key based on the package-lock.json file hash.. None of the options are correct. For a .NET application, you should add a Cache task with a key based on packages.lock.json or the project files. Option B uses package-lock.json (npm), which will cause cache misses and fail to improve build times for .NET dependencies.

Answer

Configure a Build Retention Policy to keep only the latest build.

Answer

Use Pipeline Artifacts to store dependencies between builds.

Answer

Enable Incremental builds in the pipeline settings.

Question 12

Your build pipeline includes a task that runs unit tests. You want to ensure that if any test fails, the pipeline stops immediately and does not proceed to the next tasks. What should you configure in the pipeline?

Accepted Answer

Set the 'Continue on error' option to false for the test task.. In Azure Pipelines, the 'Continue on error' option, when set to false (the default), causes the task to fail the pipeline if it fails. Setting it explicitly to false ensures that a unit test failure stops the pipeline immediately, preventing subsequent tasks from running.

Answer

Add a custom condition to the test task to only run if previous tasks succeeded.

Answer

Set the 'Always run' option for the test task.

Answer

Ensure the task control option 'Run this task' is set to 'Only when all previous tasks have succeeded'.

Question 13

Which TWO triggers can be used to start a pipeline automatically in Azure Pipelines? (Choose two.)

Accepted Answer

Pipeline completion trigger. Option A, the pipeline completion trigger, is correct because Azure Pipelines supports the `pipeline` resource with a `trigger: true` setting, which automatically starts a pipeline when a specified source pipeline finishes. Option B, the continuous integration (CI) trigger on a branch push, is correct because a `trigger:` block in YAML (or the CI trigger in classic pipelines) causes the pipeline to run automatically whenever code is pushed to an included branch. Option D, the schedule trigger, is correct because a `schedules:` block with a cron expression automatically starts pipeline runs at defined times. Option E, the pull request (PR) trigger, is correct because a `pr:` block automatically runs the pipeline when a pull request is opened or updated against the configured branches. Option C, manual trigger via the DevOps portal, is not correct because it requires a user to click 'Run pipeline' and is therefore not automatic.

Answer

Manual trigger via the DevOps portal

Question 14

You have a multi-stage pipeline that builds a .NET application and deploys it to Azure App Service. The build stage produces a drop artifact that is used by the deployment stage. Recently, the deployment stage started failing intermittently with a '403 Forbidden' error when trying to download the artifact. The service connection used for deployment has 'Contributor' role at the resource group level. The artifact is stored in Azure Artifacts. What is the most likely cause of the failure?

Accepted Answer

The service principal used by the service connection lacks 'Reader' permissions on the Azure Artifacts feed.. The 403 Forbidden error when downloading an artifact from Azure Artifacts indicates an authorization failure. Even though the service connection has Contributor role at the resource group level, this role does not grant permissions to read from Azure Artifacts feeds. Azure Artifacts uses its own separate permission system; the service principal must be explicitly granted at least Reader permissions on the specific feed to download packages or artifacts. Without this, the deployment stage cannot access the drop artifact. Note that this would cause persistent failures whenever the artifact is downloaded, so the 'intermittent' description in the scenario is a distractor.

Answer

The service connection does not have 'Website Contributor' role on the App Service.

Answer

The pipeline has 'Limit job authorization scope to current project' enabled, restricting access to the artifact.

Answer

The artifact is stored in a different Azure region than the App Service, causing a cross-region access error.

Question 15

Your team uses GitHub Actions for CI/CD. You need to enforce that all pull requests to the main branch pass a required status check that runs a security scan. The security scan is a GitHub Action that runs on pull_request events. However, the status check is not appearing as required in the branch protection rules. What should you do?

Accepted Answer

Ensure the workflow has a name that matches the status check name in the branch protection rule.. GitHub branch protection rules require the status check name to exactly match the workflow name (or the job name within the workflow) as it appears in the GitHub Actions UI. If the names do not match, the check will not appear as an option in the required status checks list. The security scan action runs on pull_request events, so the status check is generated, but the mismatch prevents it from being selectable as a required check.

Answer

Add 'types: [opened, synchronize]' to the pull_request trigger.

Answer

Change the trigger from 'pull_request' to 'pull_request_target'.

Answer

Use a GitHub App instead of the default GITHUB_TOKEN for the action.